What does "apt policy debian-archive-keyring" show? Which version (if any) do you have installed? You could also try "apt install debian-archive-keyring" This should clear up the issues with stretch-updates, but not the virtualbox repository. For that you'll need to find, verify and import the relevant key for that repository to get apt to accept it. Note that virtualbox is available from Debian itself in stretch- backports.